IN THE CLAIMS: 



1. (Currently Amended) A method of detecting a non-virus component in a virus- 
protected computer system having antivirus software comprising: 

identifying a software trace of the non-virus component; and 

conveying the trace to the computer system as a virus pseudo-signature to allow 

detection of the non-virus component by the system's antivirus software.,. 

wherein the component is a hardware device and wherein the software trace is 

indicative of the presence of the hardware device in the computer system . 

2. (Original) A method according to claim 1 wherein the trace is conveyed to the 
computer system as part of an update procedure, whereby additional virus signatures 
or scanning engines may also be passed to the antivirus software. 

3. (Canceled) 

4. (Currently Amended) A method according to claim 3 1 wherein the software trace is 
resident in a volatile area of the system's memory. 

5. (Original) A method according to claim 1 wherein the pseudo-signature is tagged or 
otherwise marked to distinguish it from authentic virus signatures. 

6. (Original) A method according to claim 5 wherein the antivirus software is modified so 
as to react differently to the presence of pseudo and authentic virus signatures. 

7. (Original) A method according to claim 6 wherein the modification is effected as part 
of the update procedure. 

8. (Original) A method according to claim 6 wherein the antivirus software does not 
attempt to fix, clean, modify or delete the component associated with the pseudo- 
signature. 



4 



9. (Original) A method according to claim 6 wherein detection of the pseudo-signature 
causes an advisory message to be conveyed to a user of the system, advising the user 
of the presence of the detected component. 

10. (Original) A method according to claim 6 wherein detection of the pseudo-signature 
effects a connection to a website providing details of the component concerned. 

11. (Currently Amended) A method of facilitating the detection of a non-virus 
component in a first virus-protected computer system comprising: 

identifying, on a second computer system, a software trace of the non-virus 
component, and 

conveying the trace towards an antivirus update source,, 

whereby the software trace may be passed, as a virus pseudo-signature, to the 
first computer systeiu, 

wherein the component is a hardware device and wherein the software trace is 
indicative of the presence of the hardware device in the first computer system . 

12. (Currently Amended) A method of detecting, in a virus-protected computer system, 
the presence of a non-virus component comprising: 

receiving a virus pseudo-signature associated with a software trace of the non- 
virus component, and 

comparing the pseudo-signature with software traces disposed within the 
system's memory, 

wherein the component is a hardware device and wherein the software trace is 
indicative of the presence of the hardware device in the computer system . 

13. (Currently Amended) A method according to claim 12 wherein, in the event of a 
match being found, the antivirus software of the system is operative to convey, to a user 
of the system, an advisory message advising of the presence of the detected non-virus 
component. 



5 



14. (Currently Amended) Apparatus for detecting, in a virus-protected computer system, 
a non-virus component, comprising: 

a pseudo-signature generation element operative to produce a software trace of 
the non-virus component, and 

an antivirus support source i 

whereby the software trace may be conveyed, as a virus pseudo-signature, to 
the computer system, 

wherein the component is a hardware device and wherein the software trace is 
indicative of the presence of the hardware device in the computer system . 

15. (Currently Amended) An antivirus update sourc e system having comprising: 

a reception element operative to receive software traces indicative of the 
presence, in a computer system, of a non-virus component, and 

a dispatch element operative to convey virus signatures to a plurality of computer 
systems in addition to a pseudo-signature produced in response to the received 
software trace, 

wherein the component is a hardware device and wherein the software trace is 
indicative of the presence of the device in the computer system . 

16. (Currently Amended) An antivirus update system of claim 15, wherein at least one 
of the plurality of computer system comprises An an antivirus software element having 
a virus scanning engine and a signature table containing a plurality of virus signatures, 
the element also having a distinguishing capability whereby the element responds 
differently to the detection of virus signatures and virus pseudo-signatures, the latter 
being indicative of the presence of a non-virus component in a host the at least one 
computer system. 

17. (Currently Amended) A method according to claim 1 , wherein the antivirus software 
Us e of an antiv i rus softwar e el o mont to d e t e ct, in a virus - protoctod computor syst e m, a 
non-virus component, comprising r e c e iving receives a the virus pseudo-signature 
generated from a the software trace of the component and scanning scans a the host 



6 



computer system , us i ng th e softwar e el e m e nt, so as to detect the presence of any 
component therein, having a matching software trace. 

18. (Currently Amended) A method of detecting a non-virus component in a virus- 
protected computer system having antivirus software comprising: 

identifying a software trace indicative of the presence of a hardware device in the 
computer system; and 

conveying the trace to the computer system as a virus pseudo-signature to allow 
detection of the device by the system's antivirus software., 

wherein the trace is conveyed to the computer system as part of an update 
procedure, 

whereby additional virus signatures or scanning engines may also be passed to 
the antivirus software. 

19. (Currently Amended) A method according to any on e of th e pr e ced i ng cla i ms claim 
1 wherein the pseudo-signature is tagged or otherwise marked to distinguish it from 
authentic virus signatures. 

20. (Original) A method according to claim 19 wherein the antivirus software is modified 
so as to react differently to the presence of pseudo and authentic virus signatures. 

21 . (New) A system of detecting a non-virus component in a virus-protected computer 
system having antivirus software comprising: 

means for identifying a software trace indicative of the presence of a hardware 
device in the computer system; and 

means for conveying the trace to the computer system as a virus pseudo-signature 
to allow detection of the device by the system's antivirus software, 

wherein the trace is conveyed to the computer system as part of an update 
procedure, 

whereby additional virus signatures or scanning engines may also be passed to 
the antivirus software. 
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